3 ms·
Except for certain applications that want to do their own DNS, eg DOH...
by imglorp 6y ago
Except for certain applications that want to do their own DNS, eg DOH...
- Arnavion 6y agoNot the person you responded to, but I too run my own resolver on my router. I also have the router configured to drop [1] all outgoing packets to any DoH IPs; there are a bunch of lists for those, like https://github.com/Sekhan/TheGreatWall https://github.com/Sekhan/TheGreatWall [1]: Specifically, to reject them, which means sending a TCP reset / ICMP unreachable response back rather than blackholing them.
- rgroj 6y agoAre you aware of "Adaptive DNS Resolver Discovery"[1] and do you have plans to block that too? (It's already in iOS 14 and slated for macOS 11.) 1: https://datatracker.ietf.org/doc/draft-pauly-add-resolver-discovery https://datatracker.ietf.org/doc/draft-pauly-add-resolver-di...
- Arnavion 6y agoSo if I understand this correctly, this provides a way for example.com to suggest a DoH server that the client can use to resolve example.com's subdomains? I can see it being problematic because it'll bypass my resolver's ad-blocking. I don't use any Apple software or hardware, but if Firefox starts using it I'll start worrying about it.
- rgroj 6y agoYes, that's right. I don't know whether this is on the agenda for Firefox or not.
- ignoramous 6y agoI run a DoH resolver domain-fronted by Cloudflare... Blocking it at IP level would mean blocking other Cloudflare proxied websites. With IPv6, a DoH endpoint rotating between various IPs might get even more trickier to block. A better strategy might be to look at the SNI for hostname at least until ESNI becomes prevalent (the one I run supports ESNI already).
- dsr_ 6y agoWhich is why my nameservers answer NXDOMAIN to use-application-dns.net, which DoH-using applications are supposed to honor. And I supply DNS-over-TLS and DNS-over-HTTPS locally. It's really not too difficult.